Fix NULL alarm_timer pointer at exit

This fixes a SIGSEGV error on qemu exit. Here is the valgrind output related to this error ==3648== Process terminating with default action of signal 11 (SIGSEGV) ==3648== Access not within mapped region at address 0x8 ==3648== at 0x40636B: host_alarm_handler (vl.c:1345) ==3648== by 0x52D807F: (within /lib/libpthread-2.9.so) ==3648== by 0x5C0A12E: tcsetattr (in /lib/libc-2.9.so) ==3648== by 0x4DD601: term_exit (qemu-char.c:700) ==3648== by 0x5B636EC: exit (in /lib/libc-2.9.so) ==3648== by 0x5B4B5AC: (below main) (in /lib/libc-2.9.so) This simple fix check for a valid pointer as host_alarm_handler is also called after alarm_timer is released in the exit path. Signed-off-by: Jean-Christophe DUBOIS <jcd@tribudubois.net>

Fix NULL alarm_timer pointer at exit
This fixes a SIGSEGV error on qemu exit. Here is the valgrind output related to this error ==3648== Process terminating with default action of signal 11 (SIGSEGV) ==3648== Access not within mapped region at address 0x8 ==3648== at 0x40636B: host_alarm_handler (vl.c:1345) ==3648== by 0x52D807F: (within /lib/libpthread-2.9.so) ==3648== by 0x5C0A12E: tcsetattr (in /lib/libc-2.9.so) ==3648== by 0x4DD601: term_exit (qemu-char.c:700) ==3648== by 0x5B636EC: exit (in /lib/libc-2.9.so) ==3648== by 0x5B4B5AC: (below main) (in /lib/libc-2.9.so) This simple fix check for a valid pointer as host_alarm_handler is also called after alarm_timer is released in the exit path. Signed-off-by: Jean-Christophe DUBOIS <jcd@tribudubois.net>
Jean-Christophe Dubois · Anthony Liguori
1 parent e6ade764
Showing 1 changed file with 2 additions and 2 deletions
vl.c
@@ -915,7 +915,7 @@ struct qemu_alarm_timer {
 static inline int alarm_has_dynticks(struct qemu_alarm_timer *t)
 {
-    return t->flags & ALARM_FLAG_DYNTICKS;
+    return t && (t->flags & ALARM_FLAG_DYNTICKS);
 }
 static void qemu_rearm_alarm_timer(struct qemu_alarm_timer *t)
@@ -1349,7 +1349,7 @@ static void host_alarm_handler(int host_signum)
         qemu_timer_expired(active_timers[QEMU_TIMER_REALTIME],
                            qemu_get_clock(rt_clock))) {
         qemu_event_increment();
-        alarm_timer->flags |= ALARM_FLAG_EXPIRED;
+        if (alarm_timer) alarm_timer->flags |= ALARM_FLAG_EXPIRED;
 #ifndef CONFIG_IOTHREAD
         if (next_cpu) {